An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page.
References
| Link | Resource |
|---|---|
| https://forum.obsidian.md/t/embedded-web-pages-in-obsidian-canvas-can-use-sensitive-web-apis-without-the-users-permission-grant/54509 | Exploit |
| https://forum.obsidian.md/t/obsidian-release-v1-1-14-insider-build/54595 | Release Notes |
| https://github.com/fivex3/CVE-2023-27035 | Exploit Third Party Advisory |
Configurations
History
06 May 2023, 03:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://forum.obsidian.md/t/obsidian-release-v1-1-14-insider-build/54595 - Release Notes | |
| References | (MISC) https://github.com/fivex3/CVE-2023-27035 - Exploit, Third Party Advisory | |
| References | (MISC) https://forum.obsidian.md/t/embedded-web-pages-in-obsidian-canvas-can-use-sensitive-web-apis-without-the-users-permission-grant/54509 - Exploit | |
| CWE | CWE-276 | |
| CPE | cpe:2.3:a:obsidian:obsidian:1.1.9:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
01 May 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-01 22:15
Updated : 2024-02-04 23:37
NVD link : CVE-2023-27035
Mitre link : CVE-2023-27035
CVE.ORG link : CVE-2023-27035
JSON object : View
Products Affected
obsidian
- obsidian
CWE
CWE-276
Incorrect Default Permissions